EUVD-2026-38030Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable gRPC service with no auth when misconfigured gives AV:N/AC:L/PR:N/UI:N; instrument read/write yields C:H/I:H, but no availability impact is described so A:N.
Primary rating from Vendor (NI).
CVSS VectorVendor: NI
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions.
AnalysisAI
Unauthenticated network access to NI grpc-device 2.17.0 and earlier is possible when the server is deployed without TLS configuration and bound to a non-loopback interface, exposing instrument control services to anyone on the local network. The flaw stems from insecure default credentials behavior and aligns with CWE-306 (missing authentication for a critical function). No public exploit identified at time of analysis, though the CVSS 4.0 base score of 9.3 reflects high confidentiality and integrity impact under default-prone deployments.
Technical ContextAI
NI grpc-device is National Instruments' gRPC-based server that exposes hardware instrument drivers (NI-DAQmx, NI-VISA, etc.) so remote clients - often InstrumentStudio or custom test executives - can control physical test and measurement hardware over the network. gRPC services typically rely on TLS plus token or mutual-cert authentication; this CVE reflects CWE-306 because when an operator binds the server to 0.0.0.0 or another routable interface without enabling the optional TLS/credential configuration, the service accepts unauthenticated RPCs by default. The vulnerability therefore lives in the deployment-time security posture of the server rather than a parser or memory bug, and it co-affects InstrumentStudio per the CPE list because that product consumes the same grpc-device backplane.
RemediationAI
Patch available per vendor advisory - consult the NI security bulletin at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html and the GitHub Security Advisory GHSA-fhhw-37q8-6562 for the fixed grpc-device build; an exact fixed version was not provided in the input data, so verify the target release on the advisory before deploying. Until the patched build is rolled out, enable TLS plus client credential configuration on every grpc-device instance, or rebind the server to 127.0.0.1/loopback only, which eliminates remote exposure at the cost of preventing legitimate remote test clients from connecting. As a network-layer compensating control, place grpc-device hosts behind a host firewall or VLAN ACL that restricts the gRPC listening port to known test-controller IPs; this preserves remote functionality but adds operational overhead when test infrastructure changes.
More in Grpc Device
View allRemote code execution in NI grpc-device 2.17.0 and earlier is possible when an attacker sends a specially crafted Monike
Denial of service in NI grpc-device 2.17.0 and prior allows remote unauthenticated attackers to crash the data moniker s
Remote denial of service in NI grpc-device 2.17.0 and earlier allows unauthenticated network attackers to crash the stre
Denial of service in NI grpc-device 2.17.0 and earlier allows an authenticated remote attacker to crash or destabilize t
Silent integer truncation in NI grpc-device 2.17.0 and earlier allows unauthenticated network-accessible attackers to co
Memory exhaustion denial of service in NI grpc-device's BeginSidebandStream RPC endpoint allows authenticated network at
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today